{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","domain":"Business Continuity & Disaster Recovery","type":"corrective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-BCDR-03","description":"Back up information, software, and system images at a frequency and scope aligned to defined recovery point objectives, protect backup copies from unauthorized access and modification, and keep copies separate from the primary environment. Verify backup integrity and restorability through periodic test restores, and verify the integrity of backups before using them for restoration.","details":{"control_category":"technical","control_type":"corrective","domain":"Business Continuity & Disaster Recovery","guidance":[],"members":[{"control_id":"CP-9","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"RC.RP-03","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"A.8.13","coverage":"full","framework":"iso-27001","relationship":"superset_of"},{"control_id":"A1.2","coverage":"partial","delta":"environmental protections and recovery-infrastructure operation satisfied by companion controls","framework":"soc2","relationship":"intersects_with"},{"control_id":"PR.DS-11","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"}],"statement":"Back up information, software, and system images at a frequency and scope aligned to defined recovery point objectives, protect backup copies from unauthorized access and modification, and keep copies separate from the primary environment. Verify backup integrity and restorability through periodic test restores, and verify the integrity of backups before using them for restoration.","title":"Back up data and verify restorability","unified_id":"UC-BCDR-03"},"id":"uc:UC-BCDR-03","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-BCDR-03","sourceIds":["iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"UC-BCDR-03 — Back up data and verify restorability","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:147ae985b733872ac1b56a5c69d128a1273023f70c2ca3795bb209a971d54203","properties":{"control_id":"A.8.13","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-13-23e70806.json","targetId":"ctrl:iso-27001:A.8.13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:14ea78b8b8d3a6bcd5d3d64bfec6447b61b759e54b1300206076f1529ae570d4","properties":{"rationale":"restorable backups recover data lost to storage/disk failure","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-tech-hardware-equipment-failure-25948451.json","targetId":"risk:tech-hardware-equipment-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:241e3c4629e7ee03b280b8c6dbdb716c14622bbc5999c308fe7cfff6775e4cd3","properties":{"rationale":"keeping copies separate from the primary environment mitigates backup-facility concentration","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-bcdr-single-point-concentration-91008453.json","targetId":"risk:bcdr-single-point-concentration","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:25412b47f2a84385de376b835925da1e26b05d03f3c28397d0bc2174f69c787d","properties":{},"sourceDetailPath":"/data/v1/records/wf-s5-a655abf2.json","sourceId":"wf:S5","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:306c12f1f5a078efdce39a4a0b6a873829f51f1a60b73f926ef3074185765e41","properties":{},"sourceDetailPath":"/data/v1/records/wf-c73-fad85eca.json","sourceId":"wf:C73","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31911aad5a689fa9e972ba38e63d432c8f84c317d5d4f4e08c46451ac2986c4a","properties":{"rationale":"backups recover data from correlated same-batch disk failures","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-asset-aging-hardware-no-replacement-f3ed1c2c.json","targetId":"risk:asset-aging-hardware-no-replacement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35a31fc7add6c987252ce232dc28d6547f6dd0f27a7e5eeda2e5f6628b511732","properties":{"control_id":"RC.RP-03","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-rc-rp-03-bc148c50.json","targetId":"ctrl:nist-csf-2:RC.RP-03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3ed5941b73dd7874c840cb8bad70c3600f18763b07c45b4b69a2e628d5923309","properties":{"control_id":"A1.2","coverage":"partial","delta":"environmental protections and recovery-infrastructure operation satisfied by companion controls","framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/ctrl-soc2-a1-2-d4182682.json","targetId":"ctrl:soc2:A1.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:46327c078d832e7f157f0d88155885716e16da99b452054af3f8a553b24bbda6","properties":{"rationale":"backups kept separate and protected from modification, integrity-verified before use, enable clean restore after ransomware encryption","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6f08fca64f4d3a872e68733abe72b547cad3d863e667c68e34fd833634cfd93a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c14-c6170cdd.json","sourceId":"wf:C14","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7e6c193f55cf9535134c43820320621f0d52d0b91a3a27a0feae6c05f2b62e85","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:870ae8d6abe6b0110bb3a50cf2856ad224207e0535e1ed482bbd44d53fa55eb1","properties":{"control_id":"PR.DS-11","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-pr-ds-11-7c1a2264.json","targetId":"ctrl:nist-csf-2:PR.DS-11","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8d6fde1a588e380bceb9489561e64066ca527f0da80abd30759451205450fc39","properties":{"rationale":"off-primary backup copies survive a disaster that destroys the primary site","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-phys-damage-physical-assets-disaster-23118626.json","targetId":"risk:phys-damage-physical-assets-disaster","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:99f577029389cb0f84fcf52af310cebb9b5ebc308e9350fa29126e0ef4e1ee65","properties":{},"sourceDetailPath":"/data/v1/records/wf-d11-12a96993.json","sourceId":"wf:D11","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b06dd8979f216ebfd8a54ea6e4a2f9f3783324b5e41888b2bb10b06f271e56e0","properties":{"control_id":"CP-9","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cp-9-d9112bea.json","targetId":"ctrl:nist-800-53:CP-9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ecb165314e55dabaa0cb419a93036981b9eba0d8cc3ac9da22b9d234591bcf6b","properties":{},"sourceDetailPath":"/data/v1/records/wf-d24-a9f3daf6.json","sourceId":"wf:D24","targetDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","targetId":"uc:UC-BCDR-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0f0edc34281f1815c3603685d9c3e3ca15af218b0abca73539e3efb245f344a","properties":{"rationale":"RPO-aligned backups with verified test restores directly limit data loss and recovery time","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-bcdr-it-resilience-outage-18dfc108.json","targetId":"risk:bcdr-it-resilience-outage","type":"mitigates"}],"schemaVersion":1}